From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 69676C4321E for ; Thu, 1 Dec 2022 10:55:50 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 5F6BA85403; Thu, 1 Dec 2022 11:55:47 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=denx.de Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=denx.de; s=phobos-20191101; t=1669892147; bh=ZyMPOfPvdQHmOyGmQCtl822zcekphLNUnCgBgm9AzOQ=; h=Date:Subject:To:Cc:References:From:In-Reply-To:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=qXWIj/DgGnuHpwF214ARl/TL/R0PlT+AgB3KV8rQ4CdoVOfDYDa/JXZcWnsAK178T mgGQ6nzCnFs7f9daEbT7rxGDb+9/uWK+iPS4p3qwxVYhh4Ci8rqKamwBl1uZWF72kk jOqKmFi/foTkUstlCS7h41tZQrSfYweTTwXL7xL9Gs/LZPbll6sDW/hNkNUIYijquc w9UrSiwlYjG5UAFQyylXbtJAsNyoElYW/vViFFp4Pb7gabtLUPucxjdn6ZJRFnTqpV WIANT7eqQg7IooGi1/NefwiH4HF/2luC1hyiPmPl4ep1ov35EF+qflA+IH7o9vZB3h kOToy66hryUQg== Received: from [127.0.0.1] (p578adb1c.dip0.t-ipconnect.de [87.138.219.28]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: marex@denx.de) by phobos.denx.de (Postfix) with ESMTPSA id CE1B7853E5; Thu, 1 Dec 2022 11:55:44 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=denx.de; s=phobos-20191101; t=1669892145; bh=ZyMPOfPvdQHmOyGmQCtl822zcekphLNUnCgBgm9AzOQ=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=si6/X57pNPb9Fg083reDSNUWv88rM6dxFfrZsC9sxo1b5ODqKMNgW3BUOWe/Z4f9X A7J4rqumg/AziMZA+0iPlP44ITudrU2ECeUfEh5LMvMqiLhPRPOLR5zNMdR+5LIle+ pQwk3v6al3hS7K+8U6MAaC5U81xgklzKKmQ3cNgUsPDQPrSaLK1vMRfQuRlSMyp5GO n40mCE1mGvgJcjE4mo44n1r9ckGUiOz+0M30KHX7gusdu0VfBhUjlw6Zkh54QScleE c0JeX9IeTuRzN/zkb0cVMxPcqpmbBrEjJXL1mF3o7XB8S/ZqGxwX3VHbQMYswbOlxu WhzBSd42D/7Zg== Message-ID: <0bb976c3-0bc3-09fb-6afa-1643efe49d8e@denx.de> Date: Thu, 1 Dec 2022 11:44:13 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.5.0 Subject: Re: [PATCH] net: eth-uclass: change state before stop() in eth_halt() Content-Language: en-US To: Lukasz Majewski , Niel Fourie Cc: u-boot@lists.denx.de, Ramon Fried References: <20221130164225.766877-1-lusus@denx.de> <20221201092414.765944d9@wsk> From: Marek Vasut In-Reply-To: <20221201092414.765944d9@wsk> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean On 12/1/22 09:24, Lukasz Majewski wrote: > On Wed, 30 Nov 2022 17:42:25 +0100 > Niel Fourie wrote: > >> In eth_halt(), change the private uclass state before calling >> stop() instead of afterwards, to avoid writing to memory which >> may have been freed during stop(). >> >> In the ethernet gadget implementation, the gadget device gets >> probed during start() and removed during stop(), which includes >> freeing `uclass_priv_` to which `priv` is pointing. Writing to >> `priv` after stop() may corrupt the `fd` member of `struct >> malloc_chunk`, which represents the freed block, and could cause >> hard-to-debug crashes on subsequent calls to malloc()/free(). >> >> Signed-off-by: Niel Fourie >> Cc: Ramon Fried >> Cc: Marek Vasut >> Cc: Lukasz Majewski >> --- >> net/eth-uclass.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/net/eth-uclass.c b/net/eth-uclass.c >> index f41da4b37b3..bc3b9751e32 100644 >> --- a/net/eth-uclass.c >> +++ b/net/eth-uclass.c >> @@ -342,9 +342,9 @@ void eth_halt(void) >> if (!priv || !priv->running) >> return; >> >> - eth_get_ops(current)->stop(current); >> priv->state = ETH_STATE_PASSIVE; >> priv->running = false; >> + eth_get_ops(current)->stop(current); >> } >> >> int eth_is_active(struct udevice *dev) > > Reviewed-by: Lukasz Majewski How come nobody triggered this problem with regular ethernet in U-Boot ? If this is isolated to USB gadget ethernet, then please do not hack around this in core networking code, but rather fix the USB ethernet gadget itself. It seems that gadget code should not unregister the gadget in drivers/usb/gadget/ether.c _usb_eth_halt() , at least not fully.